A colleague asked today about a tool to decode Microsoft Windows link files.  Before I begin to discuss the tool I recommended, I'll bri...

My last post, " BlackBerry Text Message Parsing, AKA, Why I use Linux for Forensics ," had unintended but pleasant consequences: i...

A little detour from my usual posts to explain why I use Linux for forensics, though my upbringing was in Windows-based tools like EnCase.  ...

A raw image, made with dd or a variant, is still a common image format, and will not go away soon even as many argue the benefits of forensi...

Google Chrome keeps a wealth of data that is of interest to the forensic examiner.  There are tools that look at the browser history and cac...

I've searched high and low, and many times, for a good image viewer to be used in Linux-based forensics.  In the end, and despite some s...

A coworker brought me an SD card today because she could not delete any files from it.  I noticed the lock switch was missing from the card,...